feat(auth): protect aggregate console with password login

apps/api/src/infrastructure/database/migrations.ts

@@ -282,6 +282,28 @@ export const MIGRATIONS: readonly Migration[] = [
       'CREATE INDEX idx_event_journal_sequence ON event_journal(sequence)',
     ],
   },
+  {
+    id: 7,
+    name: 'aggregate-console-password-protection',
+    statements: [
+      `CREATE TABLE console_auth_config (
+        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+        protection_enabled INTEGER NOT NULL DEFAULT 0 CHECK (protection_enabled IN (0, 1)),
+        password_salt TEXT,
+        password_hash TEXT,
+        password_revision INTEGER NOT NULL DEFAULT 0 CHECK (password_revision >= 0),
+        updated_at TEXT NOT NULL,
+        CHECK ((password_salt IS NULL) = (password_hash IS NULL))
+      )`,
+      `CREATE TABLE console_auth_sessions (
+        session_hash TEXT PRIMARY KEY CHECK (length(session_hash) = 64),
+        password_revision INTEGER NOT NULL CHECK (password_revision > 0),
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL
+      )`,
+      'CREATE INDEX idx_console_auth_sessions_expires_at ON console_auth_sessions(expires_at)',
+    ],
+  },
 ];
 
 const createMigrationsTable = `CREATE TABLE schema_migrations (